Fix #12371 : access rights on contacts

Dolibarr · Nov 30, 2019 · 916954b · 916954b
1 parent 9095482
commit 916954b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php
@@ -52,7 +52,7 @@ function societe_prepare_head(Societe $object)
 
     if (empty($conf->global->MAIN_SUPPORT_SHARED_CONTACT_BETWEEN_THIRDPARTIES))
     {
-	    if (empty($conf->global->MAIN_DISABLE_CONTACTS_TAB))
+	    if (empty($conf->global->MAIN_DISABLE_CONTACTS_TAB) && $user->rights->societe->contact->lire)
 		{
 		    //$nbContact = count($object->liste_contact(-1,'internal')) + count($object->liste_contact(-1,'external'));
 			$nbContact = 0;	// TODO

diff --git a/htdocs/societe/contact.php b/htdocs/societe/contact.php
@@ -88,6 +88,7 @@
 
 // Security check
 $result = restrictedArea($user, 'societe', $socid, '&societe', '', 'fk_soc', 'rowid', $objcanvas);
+if(empty($user->rights->societe->contact->lire)) accessforbidden();